Replace the legacy points-to-balance and external points purchase flows
with direct integer balance-to-points exchange. Enforce exchange and
points-transfer limits and capability checks across the UI and REST API.
Remove duplicate comment, captcha, filing, and website-security configuration paths.
Move front submission verification to the captcha scene matrix and retire obsolete admin routes and components.
- P1: remove the duplicate "审核联动" (ai_moderate_background/submit)
block from the attachment permissions page; those settings live in
the "评论审核" / API content audit surfaces.
- P2: rename the "内容审核" submenu to "评论审核" (permissions domain).
- P4: remove the "下载/付费内容中心" page and its schema/route chain;
hardcode runtime policy so download always supports credit purchase
and paid content is limited to posts. Drop the now-dead
cms_features.download_credit flag and parse_slug_list helper.
Close the full circuit break in the badge/medal system and replace
empty default icons with preset SVG assets so badges render out of
the box:
- Add aksrt_get_worn_medal_icon() helper that renders the worn medal
image inline (with settings fallback when the Badges class is
unavailable).
- Profile header (UC) now shows the worn medal icon beside the name,
matching zibll's name row order (display_name → VIP → Medal → Level → Verify).
- Add .medal-icon / .aksrt-identity-medal vertical-align rules in UC shell.css.
- Extract SchemaUsers::default_medal_args() and preset 6 badges (rookie,
checkin-30, writer, popular, annual-star, vip-member) with real icon
URLs from assets/img/medal/ (medal-1/2/5/9/12/15.svg).
- Vue badge.js: add MEDAL_BASE helper + preset icons matching PHP defaults.
Fix modal scroll ownership and certification modal styling, store evidence as Media Library attachments, reconcile missed provider callbacks, validate currencies, and complete digital fulfillment only after durable entitlement delivery.
Capture real client IPs behind CDN, improve provider fallbacks and
negative cache, fix admin credential dependsOn for polling mode, and
map country labels to ISO codes for moderation GeoIP blocks.
Opening 余额功能 alone now enables cash-wallet pay (unless 余额支付 is explicitly off). Drop points-as-balance fallback, stop fake method injection, expose real wallet in cashiers, and honor auto_to_balance on recharge fulfill.
header_newposts_types is multi-select but PHP schema used type=select,
so validate() rejected arrays with 422. Use checkbox and allow
select+multiple arrays in SchemaProvider.
When permalink_structure is empty, rest_url() is
index.php?rest_route=/aksrt/v1. Naive base+endpoint produced
rest_route=/aksrt/v1/banners?kind=banner (query inside route value),
so WP returned rest_no_route and Banner/Hero managers 404'd.
Fold path into rest_route and append extra params as siblings.
kate522
